Show HN: Chat Circles – Anonymous Chat Site Built with D3 and WebSockets - <AUTHOR> https://chatcircles.com/ <comment><USER2> Nice ui and idea. I've build something similar some time ago, focused on books. Each book becomes a channel that is anonymous. [https://bookrepublic.app/book/Sapiens/9780099590088](https://bookrepublic.app/book/Sapiens/9780099590088)

</comment><comment><USER3> UI is amazing, but here are some issues in it.

1\. Once you go to log in - there is no menu to come back to the homepage or register page. 2\. Once you go to forgot pass, there is no menu to come back to log in page or register page.

</comment><comment><USER4> This is pretty entertaining. Congratulations.

Only problem is that it spins up my computers fans like mad. What is causing this? Moving some circles on the screen should not be a big deal computation wise, should it?

<comment><AUTHOR> Thank you! Yes I am aware of the fans issue. It has to do with D3. I am going to work on making the client more efficient to hopefully alleviate the stress that is probably unnecessarily being caused. A quick fix, for now, is to View->Zoom In in your browser or make your window smaller. Both of those temporary solutions will let you chat with no fan or way less fan.

<comment><USER5> Definitely would like to know how you figured that one out!

</comment></comment></comment><comment><USER6> This is really cool.

There should be some teleportation methods for your avatar to move around bigger rooms / find designated areas quicker

Also, a minimap HUD showing where all the people are at in the circle

<comment><AUTHOR> I am tracking with you on the teleportation idea as I want to add some order and structure to the randomness of open space. I'm thinking a logical first step would be to add a "buddy" list feature and when your buddy is online and also has their "findable" toggle flipped to on, you can "jump" to wherever they are in Chat Circles.

<comment><USER6> Teleport i would just enable by default if your on their friendslist etc

By the way, check out indie games on the internet for ideas. 2d birds height view games

E.g.

Surviv.io -battleroyale on a browser

</comment></comment></comment><comment><USER7> That looks like an interesting app! Good luck moderating this though, as users can just shove each others and spam text to hide other people's.

<comment><AUTHOR> Thanks for checking it out. I want to do everything I can to encourage high- quality chats without sacrificing a user's free speech. Right now this means doing things like giving users a toggle to see certain kinds of content if they choose to. For example, every selfie uploaded is moderated by a human and marked sfw or nsfw manually within 2 minutes. Then users can either choose to view the nsfw selfies or have them blocked. And the "shoving" you are referring to isn't actually happening. On your screen, it may look like you are moving another user, but on their screen, you are not (you aren't actually changing their position on the server). There is no easy solution to spam/trolling on an anonymous chat site, however, a bunch of smaller solutions can hopefully start to encourage users to have more meaningful interactions.

</comment></comment><comment><USER8> I love it! Circles everywhere!! Its nice to experimenting with other shapes than squares!!

</comment><comment><USER9> Looks promising !

</comment><comment><USER10> strangely entertaining</comment>


Show HN: When a non-techie wants to look like a hacker - <AUTHOR> http://yigaldviri.github.io/stam <comment><USER2> See also [http://www.hackertyper.com/](http://www.hackertyper.com/)

</comment><comment><USER3> FYI: "they immidiatly" \--> "they immediately"

<comment><AUTHOR> Thanks. My bad</comment></comment>


India's Aadhaar Software Hacked, ID Database Compromised, Experts Confirm - <AUTHOR> https://www.huffingtonpost.in/2018/09/11/uidai-s-aadhaar-software-hacked-id-database-compromised-experts-confirm_a_23522472/ <comment><USER2> I have to admire the courage of the people who have investigated and reported this, given that the entire leadership of UIDAI and its backers in the central government are intolerant of any criticism and have been known to file police complaints[1] against journalists, critics and whistleblowers. Even its visionary and leading cheerleader from the private sector preferred to imagine conspiracies rather than acknowledging its weaknesses [2].

[1]: [https://thewire.in/tech/uidai-files-fir-tribune-reporter- aad...](https://thewire.in/tech/uidai-files-fir-tribune-reporter-aadhaar- breach-story-report)

[2]: [https://timesofindia.indiatimes.com/india/theres-an- orchestr...](https://timesofindia.indiatimes.com/india/theres-an-orchestrated- campaign-to-malign-aadhaar-nandan-nilekani/articleshow/62453569.cms)

<comment><USER3> you link anything to `thewire.in`, I would call it propaganda. The other commenter on the thread asked a question about why can't the said journalist back up the claims about a $10 app.

Hate the govt all you want, but the Aadhar as you know is started by previous govt. It is if designed properly a good way to eradicate corruption for welfare schemes, so any ideas on how to do that are more appreciated than playing blame game on HN.

<comment><USER4> > you link anything to `thewire.in`, I would call it propaganda.

So you would colour everything by a certain journal with the same brush, without even looking into the reported claims? In the cited case, the content in the link (and the claim for which they were cited) is easily verified from multiple sources: [1], [2], and [3]. Even when The Daily Mail reports something outrageous and easily verified I verify it, and The Daily Mail is a tabloid.

> Hate the govt all you want, but the Aadhar as you know is started by > previous govt.

This is neither here nor there. The "previous govt." was four years ago. In these four years, the current govt. — who used to claim to be staunchly against Aadhaar back then — have turned tail and zealously forced people into registering for Aadhaar and linking it with their phones, bank accounts, and even made it mandatory for kids to attend school. "But four years ago, someone else started it!" is a pointless argument when the current party has far more than enough time to fix it, or even just acknowledge the flaws.

> so any ideas on how to do that are more appreciated than playing blame game > on HN.

Criticism is not a "blame game", unless the criticised turns it around and blames someone without accepting or refuting the criticism. Entertaining and listening to criticism _IS_ a good way to improve one's product, not stuffing one's fingers into one's ears and claiming your product is the best ever and "unhackable" and filing police complaints against your critics to silence them.

\----

1: [https://www.livemint.com/Politics/hZGXG4q43ZeeTp2HH5QlaK/Aad...](https://www.livemint.com/Politics/hZGXG4q43ZeeTp2HH5QlaK/Aadhaar- data-breach-UIDAI-files-FIR-against-The-Tribune-j.html)

2: [https://www.tribuneindia.com/news/nation/uidai-responds- afte...](https://www.tribuneindia.com/news/nation/uidai-responds-after- outrage-over-fir-against-tribune-reporter/524951.html)

3: [https://www.firstpost.com/india/uidai-files-fir-against- the-...](https://www.firstpost.com/india/uidai-files-fir-against-the-tribune- reporter-rachna-khaira-for-aadhaar-data-breach-story-4291109.html)

</comment></comment></comment><comment><USER5> I expected better discussion on HN (apart from sensationalist articles), the article does a poor job intentionally though.

Summary

1\. Existing data is not compromised

2\. Duplicate data can't be entered or overwritten

3\. BUT, ghost accounts can be created easily.

Aadhar was introduced to fight ghost accounts who siphon off subsidies provided for poor. This hack/patch defeats that purpose.

I still think this is not a big problem as it looks on surface, if Enrollment software is hacked to accept iris data from photograph,

Can't the Aadhar DB (post enrollment) be scanned for all enrolled iris data with poor quality iris data and they be monitored and deleted ?

Another problem is still there, what if the operators enroll citizens from a different country as indians, essentially creating ghost accounts (from citizens of different country). i dont know how to stop such a situation.

Biometrics is never a good model for authentication, i dont know what these people were think when they designed it.

<comment><USER6> > I expected better discussion on HN (apart from sensationalist articles)

There are three people across three different parts of the world who corroborate the report - CTO of a global technology group, a security based analyst and a professor of Computer Science. I wonder how this is "sensationalist".

> "Having looked at the patch code and the report presented by Anand, I feel > pretty comfortable saying that the report is correct, and it could allow > someone to circumvent security measures in the Aadhaar software, and create > new entries. This is pretty feasible, and looks like something that would be > possible to engineer," Wallach said.

<comment><USER7> > There are three people across three different parts of the world who > corroborate the report - CTO of a global technology group, a security based > analyst and a professor of Computer Science. I wonder how this is > "sensationalist".

OP is not negating the problem. However, the title implies that the existing database has been breached, which is not true. Author could have given a better title which implies that ghost entries could be added and existing data has not been compromised.

<comment><USER8> The whole point of the system is to give a single confirmed Identity for citizens of India.

at this point the purpose of the exercise has been voided.

Saying that "the data has not been compromised" is a red herring, thats the case for when our biomterics are lost and our privacy breached which is a whole _different_ issue with this database, one among many of its other problems.

At this point if the data is crud, whats the point of using this system?

<comment><USER9> Actually, having an Aadhar number does not imply that the person is a citizen - this is one of the statements present in the application form itself. So, it is possible for non-citizens to have an Aadhar number.

<comment><USER10> So Aadhar is meant for the whole world including our neighbouring citizens (and Intelligence agencies) of Pakistan and China ? Thank you for educating me, I didn't know that. Its truly wonderful and neighbourly that they get the convenience of self-registration without providing proof and customizing their bio-metrics during upload. Only Indian citizens should be held to a higher standard.

</comment></comment></comment></comment></comment></comment><comment><USER11> As an Indian developer, I cringe every time the government claims a system is un-hackable. Especially when contracts are handed to one of the big Indian IT companies. Having started my career in one of those companies, I saw firsthand how most of the development process was just filling in gaps. Security through obscurity was thought to be "highly secure" and security experts were non existent.

No surprises that the database was compromised. Aadhar is a fundamentally flawed system and nothing will ever be done about it.

<comment><USER12> No amount of 'security' will help here. That's because every one including the people don't give a dime about 'security' in India.

In Aadhar enrollment centers, passwords are shared. You might like to introduce an OTP like concept, but phones are shared too. 2FA? nice try, but then people also share answers to security questions. Next what? DNA authentication? Biometrics? guess what none of those are any where near reliable and they are mostly identity related things and not authentication related things.

There is also government policy. Which is lapse. Mostly run by civil servants who understand nothing about technology. IAS is largely a trivia testing exam with focus on things like meeting and group discussion skills. The head of UIDAI recently claimed that data could not have been possible stolen as the data was still in their database :)

This is a phenomenal lapse at every level.

Software is one thing, but if your people have decided to work around it, its basically all over.

<comment><USER13> +1.

We also need to consider the motivations for working around 2FA or any such authentication systems. One is convenience as you've pointed out.

The other, much bigger motivation IMO, is opportunity to make money. As the article points out once enrolment was outsourced (Rs30/enrolment) it was immediately seen a money making venture so a whole bunch of these centres with dubious credentials surfaced. They were entrusted with document verification too so they would happily accept just about any piece of paper as proof of address. Then there was a business of charging desperate people money to create Adhaar account without which they wouldn't get subsidies.

And then they shut down (50,000 or so) these enrolment centres. Did they expect that all those employed at those centres who lost their jobs to not do anything about it!? Of course they would figure out ways to enrol people!!

</comment></comment></comment><comment><USER14> Time and Time again Aadhar's privacy data have been compromised and Yet, Officials have strongly denied all those claims - only possible because still people believe all the false claims by those officials and government in terms of Aadhar. Even to the level that a guy once wrote a scraper (opensourced on github) that can fetch Aadhar info online.

It's no doubt that Aadhar was a blatant copy of bringing an SSN-type ID in India but failed terribly as the Government was more interested using Aadhar to show their domination rather than put it for actual purpose. Eg: Govt made Aadhar mandatory for Tax filing, India's Top Supreme Court denied. The same thing happened in many instances.

This is a nice lesson, why simply coping a solution from the US can't be made to work in a developing nation because the system and officials are so fragile that they need to be first fixed than the solution itself!

<comment><USER15> Aadhar is nothing like SSN. I wish it was. SSN doesn't require biometrics — Aadhar takes fingerprints and iris scans. School kids don't need SSNs to sit for their school boards. You can sit for university exams without SSNs. You can shop at Amazon without giving them your SSN[1].

[1] [https://news.ycombinator.com/item?id=15796242](https://news.ycombinator.com/item?id=15796242)

In fact SSN use has become more restricted over time, thanks to various pieces of privacy legislation. Meanwhile in India they still don't have _any_ privacy legislation last I checked, so it's open season on your data.

Aadhar is ambitious all right — an attempt to assign every every Indian resident a number and use that number as a unique key for almost everything (public or private). The surveillance opportunities this presents is breathtaking.

Of course the good folk at India Stack love this because it enables them to build better apps. Move fast and break things, indeed.

<comment><USER16> watch this ([https://www.youtube.com/watch?v=Erp8IAUouus](https://www.youtube.com/watch?v=Erp8IAUouus)) and tell me if SSN is good for even US?

</comment></comment></comment><comment><USER17> Undeniably bad, but I'm fighting off a slight sense of schadenfreude here, due to their prior claims[1].

[1] [https://www.troyhunt.com/is-indias-aadhaar-system-really- hac...](https://www.troyhunt.com/is-indias-aadhaar-system-really-hack-proof- assessing-a-publicly-observable-security-posture/)

<comment><USER18> Yes it looks like their security was really amateur hour stuff too, with a lot of the authentication done on the client side. This makes their claims that it was "hack-proof" look particularly embarrassing.

</comment></comment><comment><USER19> Apparently the breach is now being proxied by the fired private operators through government offices. Can this cashless money flow be traced? Even burner mobile phone numbers are linked to the same compromised national identity database.

Who could benefit indirectly from the breach? Could the Indian government turn to Facebook and WhatsApp for help with identity profiling? Is Facebook Indian data held in Indian data centers?

This story will find its way into future documentaries on the history of "Papers Please".

 _> in February 2018, the UIDAI terminated all contracts with common service centres as well .. Henceforth, only banks and government institutions like the postal service can enrol Aadhaar users. As a consequence, tens of thousands of young men, with rudimentary education but great familiarity with the Aadhaar system, were put out of work.

> In interviews, out-of-work operators claim they can still use the hacked > enrolment software to generate enrolment ids (the first step in the Aadhaar > registration process) and have tied up with sources working in authorised > centres who complete the registration process for a fee.

> ... creates a whole new set of problems and could defeat many of Aadhaar's > purported aims, such as reducing corruption, tracking black money, > eliminating fraud and identity theft. It also means that the Aadhaar > database is vulnerable to the same problems of ghost entries as any other > government database

> the Indian government has sought to make Aadhaar numbers the gold standard > for citizen identification, and mandatory for everything from using a mobile > phone to accessing a bank account.

> Sourcing the patch is as easy as gaining access to one of thousands of > WhatsApp groups where the patch, and the usernames and passwords required to > login to the UIDAI's enrolment gateway, are sold for as little as Rs 2,500. > Payments are made through mobile wallets linked to phone numbers that > quickly go dead after the transactions are complete._

<comment><USER20> >>> Who could benefit indirectly from the breach?

This and who will buy those data ?

Everybody scream about the hack but I've never found a comprehensive study over how these personal data are sold, abused. Maybe to break gazillions of FaceBook/github/you-name-it accounts ? Then what, who will use those data ? Thieves ? Criminals ? If it's just that well, that's a minor inconvenience.

If it's secret services of adversary powers, well, that's a whole lot different.

Anybody has facts on that ?

<comment><USER21> > Then what, who will use those data ? Thieves ? Criminals ? If it's just that > well, that's a minor inconvenience.

It's only a minor inconvenience if you can sit in a comfortable place and pontificate on Hacker News about these things. Seems like you're not even aware that people have already lost their pension money or bank account balances or didn't get food that they were entitled to and died in the process — everything related to the coercion in the Aadhaar system and how it can be misused by others for fraudulent purposes.

Perhaps your privilege in life is standing in the way of understanding how bad things are with the Aadhaar system. Please search for #AadhaarFail on Twitter, look for articles on scroll.in and thewire.in (two sites that some people do hate) and rethinkaadhaar.in.

<comment><USER20> Now I'm reading my comment again, I see how I offensed some people here. My idea was more like "globally thinking", like in "geopolitics", in that case, even a few deaths is not much (it's like people who allocate money for cancer research : they have to make sure the population is globally better; it doesn't mean every one should get out alive). And my wording was rather poor. Sorry it was absolutely not the idea I wanted to convey. Mea culpa.

</comment></comment></comment></comment><comment><USER22> Indian government site asking for aadhar data in Bihar:

[http://22.214.171.124/online/OnlineApply/Notice.aspx](http://188.8.131.52/online/OnlineApply/Notice.aspx)

They just made aadhar mandatory for every school kid in Mumbai Maharashtra. Good luck to anyone who has to share share their childrens details on an insecure platform.

<comment><USER7> > > [http://22.214.171.124/online/OnlineApply/Notice.aspx](http://22.214.171.124/online/OnlineApply/Notice.aspx)

HTTP. FFS.

<comment><USER4> It's not like HTTPS would have helped much. It's an arbitrary IP address. How is a user supposed to verify an arbitrary IP address is not an attacker? This is what '.gov.in' is supposed to be for.

</comment></comment></comment><comment><USER23> > In 2017, the UIDAI said it had blacklisted 49,000 enrolment centres for > various violations, and in February 2018, the UIDAI terminated all contracts > with common service centres as well.

Seems like they are well aware of this hack.

Skimming through the article, it seems the attacker can register himself in the system but not read data from the system. Also, there's no mention of 1.2B records being compromised.

<comment><USER24> Actually, the records are already public, remember the fiasco where Telecom Regulatory Authority of India's Chairman RS Sharma had posted his Aadhar number online. The whole point of the Aadhar Challenge was to demonstrate leaked database/Aadhar number is not an issue. Apart from the curated datasets that can be bought even on Facebook groups, it is actually very easy to mine large datasets from Google itself.

<comment><USER19> Any references on this topic?

<comment><USER24> I don't want to post any direct link to anything but you are google 'Aadhaar data leak through Google search' to vast amounts of links/references. Kinda Meta right, I know. If you want to know more about the incident you can google 'aadhaar challenge'.

</comment></comment></comment></comment><comment><USER16> One of the reasons why India needs some kind of people authentication is rampant corruption! Corruption at a scale that most of people in Europe or US cant even imagine. Add to it the culture which celebrates corruption and eulogizes people who find loopholes in system. As soon as a policy or rule is implement, someone gets to work to find a loophole and profit. Schemes and subsidies for poor get siphoned by rich and powerful by creating fake people, less than 2% of citizen's pay taxes by just disappearing in records, billions of dollars of unnamed properties exist because owners are fake people on record, someone else appears for exam on a student.

While I still dislike citizen's database, I can also see why some kind of person authenticator is needed for country like India. I sat through UIDAI architects presentations, and from what I could tell that substantial thought was given to design. So while I maintain skepticism for such database, I also believe India needs some way authenticate various transactions (monetary or otherwise). SSN is a joke, at least Aadhaar was given substantial thought.

<comment><USER25> _someone gets to work to find a loophole and profit_

Please - this is pretty much how it works everywhere, nothing unique to India.

Why do you think lawyers, accountants etc in the corporate world get paid so much? Do you remember the U.S president saying avoiding federal taxes makes him smart?

 _the culture which celebrates corruption_

What are you basing this on? There is no question there is rampant corruption, but saying the culture _celebrates_ it is taking it a bit far

<comment><USER26> > _avoiding federal taxes makes him smart?_

I avoid taxes. I contribute to my IRA, donate to charities and deduct my home office space. What I don't do is evade taxes by not declaring income.

</comment></comment></comment><comment><USER27> Unfortunately our government doesn't accept the truth. If someone tries to educate people about the vulnerability, they are labelled anti-national.

<comment><USER28> Ironic, considering the fact that protecting the privacy of citizens is in a nation's interest.

<comment><USER29> I need you to show your work on that one, guy.

</comment></comment></comment><comment><USER30> I don't know how many times this will have to be repeated. Aadhar, GST, all implemented by the worst possible companies in terms of talent. WTF is wrong here, there are plenty of talented people around. Or just crowdsource it or give it to the universities to build or something.

<comment><USER31> I want to say that maybe the really talented people / good companies have no interest in building a central database with such dystopian potential. But then again... fb, twitter, ...

<comment><USER32> Erm, Google, Microsoft, ... most of SV ?

<comment><USER31> like I said, I really _want_ to say that. Sadly that wouldn't make it true...

</comment></comment></comment></comment><comment><USER33> Is this complete incompetence? Why wouldn't they generate these numbers on some centralized secured servers only for the verified individuals? Why give away the software that generates them at all? That's like giving away your signing servers.

<comment><USER34> That is answered in the article

> B. Regunath, a software architect who led the team at Mindtree that worked > on the project, said a web-based enrolment software for Aadhaar was not > practical at the time because many parts of the country had very poor > Internet connectivity.

Of course, anyone who put id generating software on these laptops with the expectation that it would somehow remain secret was being extremely foolish. The system should have been designed taking that into account.

<comment><USER33> Even then, they could have batched the requests for IDs on the laptop, and then submitted them daily/weekly by driving the laptop to wherever the internet is.

And of course, each such laptop must have a unique hardware key that would sign these requests, so copying the software wouldn't compromise anything.

<comment><USER35> In a country of the scale of India, if your security relies on no laptop being compromised, you have no security. One is bound to be lost or stolen (or its user to accept bribes).

<comment><USER33> You didn't read my comment well. The security in my scenario doesn't rely on the laptop not being stolen. There's a hardware key. If it gets stolen, it gets blacklisted.

<comment><USER36> It will not work in India. The whole problem is that the govt pissed off the operators and incentivized them to create fake aadhar. He whole investment to setup aadhar enrollment centre was marketed as a good business which will make people decent sum of money. But that was a very optimistic approximate. Reality turned out to be far more different. Almost all operators went into a loss. To recuperate the losses, they started creating fake aadhar. Money earned for genuine aadhar is Rs. 20, vs Rs. 500+ for a fake aadhar. It was stupid for operators to not exploit the opportunity.

In this scenario a hardware key is not going to help. It'll only limit the ubiquity of the hack, but not much else.

</comment></comment></comment></comment></comment></comment><comment><USER37> If I get it:

India has a biometric database with 1B people on it!

... wow ... just wow ...

And adding new people to it is now compromised by a publically available hack, although getting 1B biometrics on board must have had an error rate that would be scary anyway.

The UUID created is needed almost everywhere, like driving license numbers elsewhere.

How much of the scare is "People can be added once but under incorrect names" perhaps wiping out criminal pasts? or "people can be added more than once"

The second is surely a search problem?

<comment><USER38> Maybe I'm in the wrong here, but I imagine most civilised countries have a database with biometrics of all of its citizens, at least fingerprints.

<comment><USER39> Biometric collection is always for specific purpose. General purpose, compulsory biometric ids exist only in Malaysia IIRC.

<comment><USER40> > Biometric collection is always for specific purpose.

But if you add up all the specific purposes, most/all people are included.

</comment></comment></comment></comment><comment><USER41> I am the guy (Regunath) quoted in this article. I had already vented out at how one of the journalists approached me with an intent to get a "balanced" view of the system and ended up writing what he wanted from a pre-determined agenda. See this : [https://twitter.com/RegunathB/status/1039411036497956864](https://twitter.com/RegunathB/status/1039411036497956864)

What is not covered in this article is that all data from client (even if compromised) is validated by a completely different system on the server-side (any decent system does this and so does Aadhaar) and the client too has undergone maybe 20 revisions to add features/fix issues - again typical of any software. The latest version of the client software, I am told, entirely boots off a secure external storage. Now, older versions might still be i use on the field. The Enrolment client software has provision to force upgrade the software and go to the extent of locking up and not allow any new enrolments. The server counterpart can also check and reject enrolments from previous versions of client software. All of this was shared to the same reporter and you can see how much (or how less) of it was actually covered in this fact finding exercise. Press has the ability to tell the truth or sensationalize, these guys chose the latter.

</comment><comment><USER42> This is a true story -

I went to a regional passport office to get my Aadhar card about 2 years ago. I sat in front of a desk with an employee - she was logged in to a website to that let her upload my picture/biometrics and info into the Aadhar system. The desk had a post-it 3 feet away from me with the login username/password written on it.

Since the operators also need to verify biometrically to login, that alone wouldn't be enough to hack it. But if you think about the general level of understanding of IT among the public, and probably even the people who wrote the software, its pretty unsurprising to see it hacked.

Even so, I don't think its really possible for a huge entity like the government (or even a large company) to learn all the practices around security/technology without making mistakes and learning under situations with real consequences. As long as they learn from these mistakes and accept failure, rather than trying to cover them up, we will get there in time.

</comment><comment><USER30> According to the article the database has not been compromised. It's a compromise of the client which can be used to add new Aadhar entries.

<comment><USER43> Yeah, that means a lot of false data has been added into the system given how widely this patched client has been circulated. I don't know what about this tells you that the database hasn't been compromised?

<comment><USER30> The first thing that came to my mind when I read the title was that all the biometrics and all were out. Which would have been much worse and which is not the case.

<comment><USER43> This is equally bad, maybe even more so given there is a good chance that a substantial number of aadhaar accounts are fake. There is, quite simply, no reasonable defense for this state of affairs.

</comment></comment></comment></comment><comment><USER44> The biometric scanners probably have big security holes too. In fact, it won't surprise me if the JTAG is left enabled and anyone can read/write the firmware!

Aadhaar needs something like TrustRank or a Web Of Trust where identity and citizenship isn't binary but a continuous number (probability) based on who and how many vouch for your identity. A lot of citizens, especially in rural areas, aren't documented very well. It's best to acknowledge that uncertainty in the system and deal with it.

The public discussion around Aadhaar is very confused. There's hardly anything wrong with a universal ID for every citizen. There are already several in India (Driving License, Passport, Voter's ID, PAN card, etc.). The real privacy issue is around (a) the govt. collecting biometric data, and (b) how much the govt. / third-party service provider learns about you when you authenticate your identity using Aadhaar. The UIDAI doesn't even want to discuss the issue in the open ("trust us, your data is secure. No proof of hacking whatsoever."), and the use of non-open-source software and closed biometric hardware is troubling. If biometric scanners are using proper encryption, who holds the keys? (My guess, the manufacturers have it, and lots of people who shouldn't have it do have it). What's needed is consensus building, maybe through a public consultation, about what the majority of people are willing to disclose to the govt. Biometric isn't an absolute necessity for Aadhaar to achieve it's stated goals. That said, recent polls show that the percentage of Indians who trust their govt. is way higher than in the west, so the govt. can probably get what it wants while playing nice.

There's also very little discussion about how secure the biometrics are. There's no info about what services are considered sensitive and need more than a fingerprint. Fingerprints maybe fine for 5 years, but I have a hard time believing they'll be constant enough for secure identity verification over 80 years. What happens when biometric fails and a significant chunk of the populace can't sign, don't remember their date-of-birth or any password, or even their full name? Again, something like a web of trust would've been helpful.

</comment><comment><USER45> I like how tough topics in India are discussed - everything is tied back to the central government. Either you a nationalist supporting the central government or you are a self proclaimed anti-nationalist who dislikes the current government and their agenda.

One of the things people need to realize is this is a bigger bureaucratic problem. It has nothing to do with current or previous government. Previous government pushed this through because it was in their agenda and the current government cried foul. Now the tables have turned.

What this tells me is that there are lot of private interests which are playing a huge role in Indian governance, irrespective of the government. And we as a people getting into petty fights about the nationalist/anti- nationalist debate are losing sight of the target.

</comment><comment><USER21> [Note: I'm anti-Aadhaar, as documented in my profile. My comments below may sound harsh because of that. Also please note that Aadhaar is a resident number, and has nothing to do with citizenship.]

Fantastic work! One of the authors of this investigative piece, Rachna Khaira, was key in exposing a major issue with the "last mile" software and how cheaply (just Rs.500/about USD 7) and easily someone could get the Aadhaar and demographic details of almost any resident in the country who's enrolled in the system. [1] UIDAI's response for her investigation was to file an FIR (First Information Report/police complaint) against her in an attempt to put her behind bars. [2]

Activists have always argued that the lack of transparency and information could mean that there are many "ghosts" (or bogus enrollments) in the Aadhaar system (which claims that it cannot have "ghosts", ignoring technological as well as biometric limitations). Now there's no saying how many of the 1.1 billion entries in the Aadhaar system are bogus. As the article states, private agencies were used to handle the enrollment and capture of biometrics and recording of demographic information. All these agencies were paid on a per-enrollment basis. Guess what incentives they would have in a country with high levels of corruption at many levels? I'm certain that a bulk of the enrollments that have been issued Aadhaar numbers are bogus.

While activists may feel vindicated that more and more holes are being exposed in the Aadhaar system (while UIDAI continues to always remain in denial mode), it's sad that hundreds of millions of people have been left vulnerable by this poorly designed and poorly implemented system.

> B. Regunath, a software architect who led the team at Mindtree that worked > on the project, said a web-based enrolment software for Aadhaar was not > practical at the time because many parts of the country had very poor > Internet connectivity.

> "People were cranking up generators just to light up power and do the > enrolment. How can they do an online upload of those packets?" asked > Regunath, who has since moved to a senior technical position at Flipkart.

What utter nonsense!!! I can't imagine someone calling themselves a software architect being so gullible and ignorant. The entire Aadhaar system is dependent on Internet access and connectivity. Post issuance, the authentication of anyone through biometrics needs real time Internet connectivity. There's no way around that (even where an OTP is generated, the initiation of the OTP sent over SMS by UIDAI has to happen by connecting to UIDAI's web based APIs). Even as recent as last year, people in some places were forced to climb trees because they couldn't get a good cellular signal and Internet connectivity. They were forced to do this because the central government pushed this system as a prerequisites for getting subsidized food (through what's called PDS or Public Distribution System). [3] UIDAI also had Windows XP as a recommended OS for these enrollment agencies. [4]

> In 2017, the UIDAI said it had blacklisted 49,000 enrolment centres for > various violations.

The _sheer hypocrisy and audacity of UIDAI_ here is that it has blacklisted all these agencies for violations without any legal action. From the time Aadhaar started in 2009/2010, this number averaged to about two agencies blacklisted every hour! But point out some security issue or a gap? You'll be facing a court case!

_____

This whole system has been patchworks of patchworks of patchworks, continuously in denial mode when experts ask questions on security, audit, privacy, etc. I would prefer that it be completely thrown out, like how UK did with its national ID program several years ago. India doesn't need such enemies from within that/who make it easier for hostile entities/groups to disrupt or decimate the country! UIDAI needs to be shutdown as well, since nobody in-charge of the organization has shown technical or critical thinking ability, or has had the humility to face questions without getting into continuous denial.

 _The verdict in the petitions against Aadhaar is pending from the Supreme Court. I hope the verdict comes to save all the residents of India, and to save the country itself._

[1]: [https://www.tribuneindia.com/news/nation/rs-500-10-minutes-a...](https://www.tribuneindia.com/news/nation/rs-500-10-minutes- and-you-have-access-to-billion-aadhaar-details/523361.html)

[2]: [https://www.firstpost.com/india/uidai-files-fir-against- the-...](https://www.firstpost.com/india/uidai-files-fir-against-the-tribune- reporter-rachna-khaira-for-aadhaar-data-breach-story-4291109.html)

[3]: [https://timesofindia.indiatimes.com/india/need-internet- to-b...](https://timesofindia.indiatimes.com/india/need-internet-to-buy-pds- rations-go-climb-a-tree/articleshow/57437975.cms)

[4]: [https://www.voltairenet.org/IMG/pdf/module3b_installation_co...](https://www.voltairenet.org/IMG/pdf/module3b_installation_configuration_of_aadhaar_enrolment_client_17122012.pdf)

</comment><comment><USER46> Govt should recover $1 Billion from Nilekani

<comment><USER47> Absolutely. That man should be behind bars for designing this atrocious system.

</comment></comment><comment><USER48> ¯\\_(ツ)_/¯ I wish I could express some kind of outrage, really, I do. This should be awful and undermines what I believe a sincere attempt to make India a better place. But really, what could they or anyone possibly expect?

</comment><comment><USER49> Off topic: I simply can't find how to opt out of tracking on HuffPost. I get a GDPR popup and the opting out path leads endless cycles (with occasional captcha solving).

<comment><USER50> Works for me, don't know if my savior is uBlock Origin, uMatrix, or I Don't Care About Cookies...

[https://github.com/gorhill/uBlock](https://github.com/gorhill/uBlock)

[https://github.com/gorhill/uMatrix](https://github.com/gorhill/uMatrix)

[https://www.i-dont-care-about-cookies.eu/](https://www.i-dont-care-about- cookies.eu/)

</comment></comment><comment><USER51> its kind of weird that they call the vulnerability itself "a patch"

I can be pedantic too and can see how there isn't really a distinction between an exploit and a patch as they both modify the software, but thats a weird colloquialism right?

<comment><USER43> It sounds to me like a game crack which are basically patches since they make the software concerned more user friendly.

</comment></comment><comment><USER52> Sad face :(

</comment><comment><USER53> It is hard to believe by relying on just one source. I just checked other news sources in India, and no one has any news about any recent Aadhaar breach.

<comment><USER24> Kindly understand this article seems to come out of investigative journalism where the author seemed to have gotten hold of the patch presumably by paying 2500 and then did in-person research to create the article. Once published, other newsrooms usually do their own pieces if they find it relevant. Since this article has just been published (only 2 hours ago at the time of writing this comment), I wouldn't refute the article just on the basis of this criteria. I would usually wait for 1-2 days before using the above criterion to evaluate the article.

<comment><USER53> You've actually reworded what I have already said. Since there is no official statement from UIDAI or multiple private news sources reporting the same incidence; this article/blog is not worth believing yet.

<comment><USER54> On the contrary. This was _investigated_ by a reporter(s) from the mentioned source and published. Other news publications need to verify it independently before publishing it themselves.

And on the "official statements" part, it's kind of naive to expect that they (UIDAI) would put out any statement given that in the past they have

\- Not acknowledged security issues or made any efforts to do their own investigation in spite of the numerous reports

\- Turned hostile towards entities who have exposed or reported weaknesses instead of rewarding them and plugging the loopholes</comment></comment></comment></comment>


Spaced Repetition for All: Cognitive Science Meets Big Data - <AUTHOR> https://medium.com/tech-quizlet/spaced-repetition-for-all-cognitive-science-meets-big-data-in-a-procrastinating-world-59e4d2c8ede1#.qrx708es4 <comment><USER2> quizlet has the massive data and engineering talent necessary to make something truly meaningful here. video summary for tl;dr [https://www.youtube.com/watch?v=sMHucmzjByE](https://www.youtube.com/watch?v=sMHucmzjByE)</comment>


Soon the yuan will pass the dollar as the 'supreme currency' - <AUTHOR> http://www.businessinsider.com/yuan-will-pass-dollar-as-supreme-currency-2015-9?IR=T <comment><USER2> That was a really bad article.

<comment><USER3> Agreed. Terrible, rambling, is there no editor checking these articles before publishing?</comment></comment>


The Surprising Breadth of Harbingers of Failure (2019) - <AUTHOR> https://journals.sagepub.com/doi/abs/10.1177/0022243719867935 <comment><USER2> Coefficients of demographic characteristics of "Harbringers of failure" zip codes:

Age -.2971

High school -.1710

Home value .2865

Bachelor's degree .1197

Income .0646

White -.3919

Single family .4047

African American .2232

Multifamily .4132

Asian .3426

Distance -.3740

Hispanic .4854

Comp. distance -.4156

Coupon discount -.2333

Nbr. households .3160

Coupon frequency -.3741

Urban .4190

Unit price paid -.0523

Urban clusters -.1603

Meaning of these variables is here: [https://docs.google.com/document/d/1d8O9ja_p08w6cSkOPZ-L1sDZ...](https://docs.google.com/document/d/1d8O9ja_p08w6cSkOPZ-L1sDZU097AdIkw1qm8wJvoZw/edit?usp=sharing)

<comment><USER3> Not only do your numbers not appear in the document you provide, one has to wade through pages and reams of stats ... And your comment still makes no sense to me.

<comment><USER2> Effectively what these mean is that, for example, if your product is popular in places where a lot of people are young white people, in a single family household, in the countryside, without a university degree it is not likely to be successful.

If your product is popular in places with a lot of older hispanic people, with a university degree, who live in the city, in an apartment building, it's more likely to be successful

</comment></comment></comment><comment><USER4> Anybody else feel like they are on both sides of this? Do these people REALLY only end up supporting the products that end up failing?

The first time I tried a 1st gen iPod, I was amazed and had to have it. Then bought a Zune HD when it came out, and kept it long into when everyone else had moved on.

Windows Phone, yup, I was a supporter. But was also doing yoga, WHM, intermittent fasting, etc. I was "barefoot" running before Born to Run came out, I rode a single speed mountain bike which never really became a thing.

I didn't read the entire report because I don't have an account, but are the people who are supposedly the "Harbingers of Failure" just more likely to be early adopters who are more likely trying new things and therefore they end up liking and supporting things that end up failing?

</comment><comment><USER5> Lol, wouldn't be surprised to find myself in one of these "loser" zip codes. Wish I could read the whole article rather than just the abstract.

<comment><USER6> [https://sci-hub.tw/https://journals.sagepub.com/doi/abs/10.1...](https://sci- hub.tw/https://journals.sagepub.com/doi/abs/10.1177/0022243719867935)

</comment></comment><comment><USER7> I feel like a software harbinger

Whenever I decide to use some software, it vanishes in insignificance. QBasic, Delphi, FreePascal/Lazarus, Micrografx Picture Publisher, Conitec 3D Game Studio, Java Applets, Mercurial hosted on SourceForge or Bitbucket, QCodeEdit, XQuery

<comment><USER8> That's funny. Sad, too. Maybe you are just different enough from others that you pick differently.

</comment></comment><comment><USER9> I started reading this article, then found myself skimming more and more as it became flakier and flakier. Now, because I just skimmed most of it, I may be missing some important points -- but my impression is that the authors are so bound up in the details & statistical tests that they can't see any big picture.

For example, in discussing household moves they talk about which zipcodes people choose to live in, as if they had perfect freedom of choice. But I don't see where they account for median income. How are we to know if people in a "harbinger" zipcode can even afford to move to a "Group 1" zipcode? Or if it would be a convenient distance from their employment?

I simply can't see putting much or any faith in these "results".

</comment><comment><USER10> My people!

</comment><comment><USER11> I wonder what drives this, is it just poor decision making ability.

<comment><USER12> Probably the same thing that makes people more likely to root for underdogs.

Avoiding the mainstream, etc.

These people arent as broken as this article may make it seem.

Its interesting how these zip codes are housing bubble resistant for example! Id wager these people arent trying to get rich, just trying to live a decent life and be nice to each other.

<comment><USER13> The ultimate crime

<comment><USER12> Not to mention they're telling us that bird of a feather like to flock together, and giving it a name such as "harbingers of failure" ...

Modern Marketing came out of WWII Psychwarfare efforts, gotta keep that in mind.</comment></comment></comment></comment>


The Key of Hell: An Enlightenment Sorcery Manual (2014) - <AUTHOR> http://theappendix.net/blog/2014/1/the-key-of-hell-a-sorcery-manual-from-the-enlightenment <comment><USER2> What strikes me is ... The drawings aren't very good. They are at my sort of level (OK a bit better). But in terms of modern professional illustrators ... They are childish.

It's amazing just how far we have come.

And worth noting anyone educated enough to read and write, obsessed enough to create a whole book (even today that's an acheievement) is not going to be a well balanced thoughtful kind. Hence, manuals of black magic with badly drawn picture...

<comment><USER3> I'm out of my depth in discussions about art history, but comparing the 18th century illustrations to the 15th century painting in the same article, I find it hard to infer a notion of progress as you do. Having said that, one could well imagine that the 18th century illustrator was deliberately attempting to evoke a medieval style.

Here are some links picked up from quick Google searches that might provide stylistic comparisons:

18th century - [http://www.theparisreview.org/blog/2015/06/09/charlie- charli...](http://www.theparisreview.org/blog/2015/06/09/charlie-charlie-are- you-there/) 14th century - [http://io9.com/bizarre-and-vulgar-illustrations- from-illumin...](http://io9.com/bizarre-and-vulgar-illustrations-from- illuminated-medie-1456202572)

</comment></comment><comment><USER4> And, for those of you who are conspiracy theorists, the link to the Wellcome Images site, item F0002901[1], is to:

" _Sanskrit Beta 1469: this image is from a Sanskrit manuscript thought to be dated 1469. This manuscript is from the genre of karmavipaka, meaning "the ripening of karma". It begins with a salutation to the sage Dhanvantari, the traditional author of the original works on Ayurveda, one of the world's oldest medical systems. It explains the karmic relationship with a given disaster or disease; listing various sinful acts together with a brief statement of the alleged consequences that follow. For example; killing a cow will cause the killer to go to hell and having sex with a priest's wife, the wife of another, a widow, or a prostitute, may lead to diseases such as ring- leprosy, bloody bile, or excessive urination. (?)_ "

which has nothing to do with Pseudo-Cyprianus.

(Just kidding. If you search for "Cyprianus", you'll find the illustrations from the article such as L0036628[2] as well as some text pages. Apparently the author just cut-n-pasted the link from the address bar after initially going to F0002901 and searching---the site doesn't update the address.)

[1] [http://wellcomeimages.org/indexplus/image/F0002901.html](http://wellcomeimages.org/indexplus/image/F0002901.html)

[2] [http://wellcomeimages.org/indexplus/image/L0036628.html](http://wellcomeimages.org/indexplus/image/L0036628.html)

</comment><comment><USER5> Darn. I was hoping to learn more about e17.</comment>


Marie Curie: Why her papers are still radioactive - <AUTHOR> http://www.csmonitor.com/Innovation/Horizons/2011/1107/Marie-Curie-Why-her-papers-are-still-radioactive <comment><USER3> It's amazing to see scientists experimenting on themselves!

I've always been impressed by what Barry Marshall did.

For years it was common knowledge that ulcers were caused by stress, spicy food, and excess acid. A "bland diet" was the prescribed palliative care for ulcers. There was no cure. And ulcers could - and often did - lead to stomach cancer.

Dr. Marshall thought that that the bacterium _H. pylori_ might be the cause. But the idea that bacteria could thrive in the acidic environment of the stomach was thought to be ridiculous.

So he tested the theory by drinking a solution of _H. pylori_ and giving himself ulcers.

He had a biopsy taken on himself to prove it was the bacteria, and then cured himself with a course of antibiotics - the same way ulcers are cured today.

Ulcers are not a chronic disease any more, and stomach cancer has become rare.

[http://discovermagazine.com/2010/mar/07-dr-drank-broth- gave-...](http://discovermagazine.com/2010/mar/07-dr-drank-broth-gave-ulcer- solved-medical-mystery)

<comment><AUTHOR> I don't think Marie or Pierre knew the ill effects of exposure to high doses of radiation. Nobody did. They had no idea (at that time) how dangerous it was.

<comment><USER4> > They had no idea (at that time) how dangerous it was.

This reminds me that every time Fukushima is mentioned on HN, the discussion is immediately dominated by people who claim that radiation exposure is not harmful (or even that it is healthy) and that contamination is not an issue in the province. To be fair, I think these days it's an ideological problem, whereas back then they just didn't have enough data and models about what's going on.

</comment></comment></comment><comment><USER5> > In 1903, Pierre Curie, after observing burns on his arm left by the chunk of > radium that he tied to it for 10 hours, concluded that he had discovered a > cure for cancer.

That's some uneasy irony.

<comment><USER6> Related: [http://www.environmentalgraffiti.com/offbeat- news/10-radioac...](http://www.environmentalgraffiti.com/offbeat- news/10-radioactive-products-that-people-actually-used/1388?image=1)

Pierre Curie died 1906, Marie lived till 1934: [http://en.wikipedia.org/wiki/Marie_Curie](http://en.wikipedia.org/wiki/Marie_Curie) "Although her many decades of exposure to radiation caused chronic illnesses (including near blindness due to cataracts) and ultimately her death, she never really acknowledged the health risks of radiation exposure."

All that doesn't diminish the significance of her work.

<comment><USER7> Pierre didn't die of cancer - he slipped off the sidewalk was run over by a carriage. Amazingly, he missed the horses, and the front wheels, but his head was smashed by one of the rear wheels; part of his skull wound up on Marie's dress, and the supposed story is that Marie never washed her dress - <USER2> wearing it until her daughter Irene finally convinced her to burn it in a pyre.

</comment></comment></comment><comment><USER8> It's very interesting to read some of the pop literature of the time. The Conan and Oz stories both refer to radium very positively as a mystical technology capable of essentially anything, which advanced societies would naturally use where they could.

People today don't look the same way, I think, on the idea of a city set deep underground, where all the lighting is provided by radium set into the walls.

</comment><comment><USER9> Marie Curie lived to be 66 at a time when the life expectancy in France was around 45. It's true her husband and co-experimenter, Pierre Curie, only lived to be 46 - he was killed by a heavy horse-drawn cart!

Perhaps we are a little too paranoid about the risks of radiation.

<comment><USER10> And smoking isn't unhealthy, because my dad is still alive and kicking at 80 years old, right?

This is the reason why the size of the samples are important.

</comment></comment><comment><USER11> Fascinating. I'm quite impressed she lived to the ripe old age of 66.

</comment><comment><USER12> please, Marie Curie.

<comment><AUTHOR> I do not understand - is there an error in the submission title ?

<comment><USER13> Marie Skłodowska-Curie is her "correct" name in some sense:

[http://en.wikipedia.org/wiki/File:Marie_Curie_Sk%C5%82odowsk...](http://en.wikipedia.org/wiki/File:Marie_Curie_Sk%C5%82odowska_Signature_Polish.svg) [http://en.wikipedia.org/wiki/Marie_Curie](http://en.wikipedia.org/wiki/Marie_Curie)

<comment><USER14> It's worth pointing out she used the full version of her name herself.

</comment></comment></comment></comment><comment><USER15> It's a good cautionary tale about how we should react to new science and technology.

While knee-jerk rejection can be annoying, skepticism is warranted!

What topics have the potential to surprise us with unforeseen downsides? I'd guess nano particles and GMOs, off the top of my head.

</comment><comment><USER16> With the advent of the FDA, the likelihood of something similar to radium as a cure for cancer is unlikely. Although, I sometimes think with experimental international stem cell therapy or kombucha, there's bound to be something...

</comment><comment><USER17> I'm shocked by Eben Byers death, related in the article, and all that radioactive quackery.

Homeopathy (to name one) today is a joke compared to what we've done in the past. Radioactive toothpaste!

I hope there's no equivalent nowadays.

<comment><USER18> > I hope there's no equivalent nowadays.

Quackery isn't quite as bad as radioactive toothpaste or heroin syrup to calm the baby, but it's still pretty bad.

People with HIV are told to stop taking "poisonous" ARV meds, and to drink a concoction of lemon juice, garlic, ginger, etc. This isn't some obscure quack either, it's the president of a country, and the health minister of that country. When the deputy health minister spoke out she was sacked. ([http://www.irinnews.org/report/73679/south-africa-deputy- hea...](http://www.irinnews.org/report/73679/south-africa-deputy-health- minister-sacked-for-doing-her-job))

Matthias Rath is, in my opinion, the embodiment of evil. His scams have killed very many people. ([http://www.irinnews.org/report/83497/south-africa-final- chap...](http://www.irinnews.org/report/83497/south-africa-final-chapter-in- rath-saga))

People talk about the evils of big pharma, and that they're only in it for the money. Pharma does have many problems, but the solution isn't to go to the greedy quacks selling vitamins as a cure for all cancer or a cure for AIDs/HIV. And Rath made a lot of money from selling vitamins.

Here's another snake oil "cure" for HIV/AIDS. ([http://www.irinnews.org/report/94679/africa-snake-oil- salesm...](http://www.irinnews.org/report/94679/africa-snake-oil-salesmen-and- dodgy-hiv-cures))

There are many examples from the developed world too. I link to the African stories because the statistics were just so mind-boggling when HIV/AIDS was at its worst.

</comment></comment><comment><USER19> I've always wanted to go into the library archives of Iowa State University with a Geiger counter and visit the physics journals from the Manhattan project.</comment>


World's first Linux powered rifle announced - <AUTHOR> http://arstechnica.com/gadgets/2013/01/17000-linux-powered-rifle-brings-auto-aim-to-the-real-world/

<comment><USER2> I wonder how much really needs done to setup the tracking software. Since they are using Linux, they have access to a huge library of code, and since it has both a stereoscopic rangefinder and a camera it shouldn't take much to do edge detection and figure out, hey, that blob that has stayed relatively close to the center of the view for the past second is the target, start tracking that. Using comparisons to the previous frame it could then handle the target moving and thus changing its profile.

A really cool demonstration of this technology would be to see a truly difficult shot. The company video [<http://tracking-point.com>] just shows people taking shots from several hundred feet away. Great, now I can shoot motionless unaware lower apparent intelligence lifeforms without even doing the math for bullet drop or wind myself, not to mention that I didn't have to track it (the video shows them flying around in a helicopter which is reasonable for someone spending $17,000 on a bolt action rifle) and I most likely didn't need this for sustenance, and the game they are shooting wasn't anywhere close to a community where population control is needed (like deer in the U.S. midwest since the natural predation cycle is broken).

Show me something awesome like a guy skydiving with this rifle and scoring a shot at something on a nearby mountain before popping out the wing suit flaps and gliding over to the kill and hoisting it by rope into a helicopter. Then release a second copy of the same video through an unaffiliated account on YouTube that is a viral meme like, "BANG, headshot!"</comment>


Show HN: Deduplicating NTFS file systems (fsdup) - <AUTHOR> https://github.com/binwiederhier/fsdup <comment><AUTHOR> There's a write-up here with some details on the why/how and a few experiments (deduping >56T in 125 raw disks): [https://blog.heckel.io/2019/07/22/deduplicating-ntfs-file- sy...](https://blog.heckel.io/2019/07/22/deduplicating-ntfs-file-systems- fsdup/)

<comment><USER2> nice write up. interesting idea too... very cool... one question though: I wonder what ZFS + DeDup or Windows Storage Spaces + DeDup would do with the same data, just out of curiosity...

<comment><AUTHOR> The idea here is to do this on a very very very large scale. My employer has a > 500 PB cloud of (mainly Windows) backups. Right now everything is on ZFS, but we're thinking about moving to a block store (like Ceph or Swift) with this dedup idea.

<comment><AUTHOR> That said, block level dedup on NTFS will lead to better dedup ratios, but at the cost of a lot more metadata and a very high metadata to data ratio.

<comment><USER2> That makes more sense then. Plus, the larger the data set, the more chance (in theory) of duplicates... especially windows system files, etc.</comment></comment></comment></comment></comment>


What is Computer Science? - <AUTHOR> http://jxyzabc.blogspot.com/2013/01/what-is-computer-science.html

<comment><USER2> Hmm... I'm trying to balance "...a non-technical friend..." against "...P, the class of problems with polynomial-time algorithms, and NP, a class of problems for which polynomial-time algorithms are not known...".

I think this post says as much about computer scientists as it does about computer science.</comment>


LivIcons - Exclusive Truly Animated Icon Pack - <AUTHOR> http://livicons.com/ <comment><USER2> Truely amazing icon-pack. I hope more animated icons will be added later.</comment>


Ask HN: Should I change my start up's name? - <AUTHOR>

My start up is BugMuncher - I chose the name specifically because it's similar to rug muncher, which made me chuckle (and also because the .com was available).
At first I had a lot of people telling me they loved the name, but recently I've had a small number of people (only 3 in total) telling me they like the app, but the name is problem for them or their clients, because it sounds like rug muncher.
What I worry about is the possibility of people seeing BugMuncher, but not signing up because of the name - I'd never know. I really like the name, but is that just foolish pride? Should I just suck it up and rename to something that couldn't put people off?
Thanks in advance, <comment><USER2> I like the name, very memorable.

So you had 3 people say they are out because of the name? How many users do you have in total. 3 people opting out with only 5 users is a lot different than 3 people opting out with 5,000 users.

</comment><comment><USER3> seems like you could release it under 2 different names with same code. you should be able to check which domain someone logs in under and change images text.</comment>


OpenBSD removes support for non-UTF8 locales - <AUTHOR> http://marc.info/?l=openbsd-cvs&m=143956261214725&w=2 <comment><USER2> I wonder what the pros and cons weighed in the discussion were.

Clearly not supporting Unicode text in non-UTF-8 locales (except through, like, some kind of compatibility function, like recode or iconv) is the Right Thing. One problem that I have is that current UTF-8 implementations typically are not "8 bit clean", in the sense that GNU and modern Unix tools typically attempt to be; they crash, usually by throwing an exception, if you feed them certain data, or worse, they silently corrupt it.

Markus Kuhn suggested "UTF-8B" as a solution to this problem some years ago. Quoting Eric Tiedemann's libutf8b blurb, "utf-8b is a mapping from byte streams to unicode codepoint streams that provides an exceptionally clean handling of garbage (i.e., non-utf-8) bytes (i.e., bytes that are not part of a utf-8 encoding) in the input stream. They are mapped to 256 different, guaranteed undefined, unicode codepoints." Eric's dead, but you can still get libutf8b from [http://hyperreal.org/~est/libutf8b/](http://hyperreal.org/~est/libutf8b/).

<comment><USER3> I'm willing to bet a large amount that non UTF-8 encoding were broken and nobody cared enough to bother fixing them.

OpenBSD does not hesitate to nuke legacy stuff that gets broken. Which i feel is ultimately for the best, because half-assed support that barely functions is worse than no support at all many times.

<comment><USER4> It was in fact intentionally broken to find out where removing single-byte locales hurts our users most.

We have a hackathon coming up with devs committed to making UTF-8 work in more base utilities. If that works out, and the most sore points of latin1/koi-8/etc users have been adequately addressed, 5.9 will ship with only the UTF-8 locale (and of course the default "C" locale -- ASCII).

If this approach turns out to be wrong because we cannot get regressions fixed, 5.9 will ship like 5.7 and 5.8 (with UTF-8 and single byte locales).

<comment><USER5> My first thought was, what about the "C" locale so good to see that question already answered.

I really wish there was some sort of standard "U" locale that would be the same as "C" but UTF-8, and ISO rather than US format dates.

<comment><USER6> That locale pseudo-exists. It's called "don't call the evil setlocale function, write in C90 as much as possible, do your own UTF-8 encoding and decoding, and implement the exact default date format you want with your own strftime string or whatever."

<comment><USER7> That doesn't exactly help me as a user, and possibly makes things worse as some things respect locale and some don't.

</comment></comment></comment></comment></comment></comment><comment><USER8> As a French-speaking person, I cannot tell you how much the announcement[0] that after 5.8, basic utilities, including mg(1), will be UTF-8 ready pleases me. I'm a huge Emacs fan, but I like to use mg(1) for quick edits and this is very exciting news for me!

[0] [http://undeadly.org/cgi?action=article&sid=20150722182236](http://undeadly.org/cgi?action=article&sid=20150722182236)

<comment><USER9> Funny thing about Emacs and OpenBSD...

...Emacs is the only package in the entire ports tree that can't use ASLR.

<comment><USER10> That can't possibly be true, the Go port also doesn't use ASLR.

<comment><USER9> I'm just quoting what an OpenBSD dev mentioned to me. I guess there could be more.

</comment></comment></comment></comment><comment><USER11> I dream of a world where everything is UTC, UTF-8, and metric.

<comment><USER12> Personally, I wish everyone used the 24:00 clock. Maybe the military has messed me up, but I really prefer seeing something like 18:22 over 6:22pm. It just seems simplier.

<comment><USER13> Yes couldn't agree more with that.

Also dates in numeric order I.e. yyyy/mm/dd you know like all the other numbers we deal with not dd/mm/yyyy or the crazy mm/dd/yy.

<comment><USER14> Use minus instead of slash and you have ISO 8601: yyyy-mm-dd

<comment><USER13> Sold.

<comment><USER15> 8601 also gives you proper week numbering (which Europeans tend to like) + weeks start on Monday, _after_ the weekend.

<comment><USER16> Well it's all the weekend. Saturday is the last end of the week and Sunday is the front end of the week.

<comment><USER17> In the US perhaps, not in Europe

<comment><USER18> In the UK too traditionally, although that's changing (by convention).

<comment><USER6> Yet, in America, people say things like "do you have plans for the weekend?" Or, "What did you do last weekend?"

Nobody ever says, "Do you have plans for the upcoming two days which, respectively, constitute the end of this week and the start of the next one?"

So, Americans and Brits are inconsistent. They have "the weekend" which is a block of two days when salaried people with regular working hours don't work; and they have Sunday as not the week end, but rather the beginning; or the "front end" of the next week. Which means that the two days cannot be _the_ weekend; they are two different ends of two different weeks.

> that's changing (by convention)

It's changing because people have to confront the above reasoning and realize that a week beginning in the middle of something that they have been calling "the weekend" for decades is silly.

<comment><USER19> Neither does anybody say "What are you doing for the holidays constituted of Christmas Day and selected other days around it?"

<comment><USER20> Christmas has 3 days.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> Heh, I initially read it as "improves", and was wondering why they'd bother. Removing it is surprising, but makes sense.

</comment><comment><USER22> How does locale work on the keyboard side, then? What determines whether text entry is right to left or left to right?

<comment><USER23> Exactly the same as before -- your programs just expect UTF8 codepoints as input.</comment></comment>


Ask HN: What are best ways to determine a pricing strategy? - <AUTHOR>

Our startup is starting to look at various pricing strategies. We're debating the merits of having one pricing plan vs. multiple, and are considering ways of determining a fair monthly price for our service.
HN Community, how do you determine the best pricing strategy, in terms of the type of plan offered & how much you charge?
In advance, thanks for your time! <comment><USER2> Determine how much value does your product delivers to the customers. Let's say if it saves them $500/month, you can easily charge/they will happily pay at least $100/month.

Regarding what type of plan, you should think about what do your customer demographic look like. If they are same type of people with same type of needs, give them one price. I tend to support one-price only, because that reduces troubles like different settings on the backend, have customers to decide, and communicate the differences clearly, etc.

</comment><comment><USER3> Focus group and test markets. Do focus groups of your target customer to get an idea on optimal pricing. Then randomly create separate pricing points and monitor the conversion rate. Find the point of profit optimization (# of sales vs. profit) and you have your price. Beware you also want to be aware of any growth rate influence (word of mouth) that might occur at different pricing points.

</comment><comment><USER4> There is a book on software pricing: Don't just roll the dice by Neil Davidson. You can get it free on his website: <http://www.neildavidson.com/dontjustrollthedice.html></comment>


Facebook will soon update code to nullify AdBlock Plus' workaround - <AUTHOR> https://techcrunch.com/2016/08/11/friendblock/ <comment><USER2> To be followed shortly by:

> Adblock Plus updates code to nullify Facebook's workaround of Adblock Plus > workaround

</comment><comment><USER3> How do they intend for ads to be human distinguishable but not computer distinguishable?

To be human distinguishable there must be some style or content difference that the browser is aware of.

<comment><USER4> why would it be a goal of FB for the ads to be human distinguishable from the rest?

<comment><USER3> It's a legal requirement in some places, and they'll lose users otherwise.

</comment></comment></comment><comment><AUTHOR> And so the arms race begins. Or reaches it's peak. Whatever.</comment>


Reddit Users Steal Thousands Of Games From Electronics Arts - <AUTHOR> http://www.redorbit.com/news/technology/1112713194/reddit-electronics-arts-free-games-101512/

<comment><USER3> Better summary: "EA's coupon code hacked, gave away thousands of free licenses."

Doesn't sound so bad does it? EA should shoulder the blame for a hackable system that didn't have anyone closely monitoring for fraud. Also, would these people have actualy purchased the game? Are the licenses transferable? - <USER2> not, there might not have actually been much loss.

</comment><comment><USER4> "EA Screws up and gives away thousands of games" is a better title. If Wallmart misprints a coupon giving away hundreds of lawn chairs, we hardly blame the people claiming the lawn chairs.

</comment><comment><USER5> Not stealing if their own system allows it.</comment>


The World's Largest Wind Turbines Have Started Generating Power in England - <AUTHOR> https://www.technologyreview.com/s/607908/the-worlds-largest-wind-turbines-have-started-generating-power-in-england/ <comment><USER2> The turbines are produced by the Danish/Japanese company MHI Vestas Offshore Wind. The swept area of the blades is approx. 30% larger than the area of the London Eye ferris wheel.</comment>


Show HN: An Open Source Deep Learning/Machine Learning Stack on Kubernetes - <AUTHOR> https://polyaxon.com/ <comment><USER2> Hi. You should also have a look at Helical Insight. It is also an open source BI software. It is worlds first open BI tool with machine learning and NLP, allowing users to type their questions and get immediate business answers. It also has an inbuilt workflow functionality allowing to trigger any of the functional module of BI whenever you want, thus helping you implement any sort of business process.

Also with a completely SOA driven archtiecture, the API allows to add functionalities at any layer (like data connection, charting, exporting, emailing, user role management, caching etc) without depending on the vendor.

Coming from Open source BI background, I would request you to please do download and give it a try. [http://www.helicalinsight.com](http://www.helicalinsight.com)</comment>


Crossing The PhoneGap For Multiplatform Mobile Applications - <AUTHOR> http://deadprogrammersociety.blogspot.com/2010/01/crossing-phonegap-for-multiplatform.html <comment><USER2> Blogspam. Blah blah, "I didn't pay attention initially", blah blah, "here's a condensed version of their site", blah blah. Just link to the original site then if you have nothing to offer.

<comment><USER3> Actually, in my post I explain things not available elsewhere, such as how to actually get setup for PhoneGap multiplatform development using git submodules. Hence the name of the post.

If you are referring to my narrative writing style, sorry if you do not like it. I also like to credit my sources, so sorry if that seems like spam to you.</comment></comment>


Ask HN: Gitbook is too expensive, what is an alternative? - <AUTHOR> Thinking Gitbook was like the legacy version i have produced some docs using the cloud service. Bad research on my part but i now realise Gitbook is a cloud service with a subscription, which is costly to say the least.<p>I can host any alternative myself. Ideally I would like to be able to export from Gitbook and import to the alternative? <comment><USER2> Take a look at [https://v2.docusaurus.io/](https://v2.docusaurus.io/).

<comment><AUTHOR> Thanks, Favour Vue.js here so would probably use VuePress if I go this route.

Interesting information on other solutions, here: [https://v2.docusaurus.io/docs/introduction/#comparison- with-...](https://v2.docusaurus.io/docs/introduction/#comparison-with-other- tools)</comment></comment>


Giant Pigs Size of Polar Bears Being Bred in China - <AUTHOR> https://www.bloomberg.com/news/articles/2019-10-06/china-is-breeding-giant-pigs-the-size-of-polar-bears <comment><USER2> Hm. Iowa.

[https://whoradio.iheart.com/content/2019-08-09-captain-is- th...](https://whoradio.iheart.com/content/2019-08-09-captain-is- the-2019-iowa-state-fair-biggest-boar/)</comment>


Petabytes on the cheap - <AUTHOR> http://ha.ckers.org/blog/20100721/petabytes-on-the-cheap/

<comment><USER2> As someone essentially in charge of petabytes of storage; one of these will not safely, securely or successfully do the job alone.

I used to use this method with normal 4U server chassis and 20 x 1.5TB hard drives. Multiple issues and availability problems have meant now we use multiple 2U chassis with 4 x 2TB drives to serve the same job.

It works out cheaper in the long run :)

(It works for Backblaze because they essentially have the same thing but scaled up massively)

</comment><comment><USER3> The "custom metal case" seems to be kind of a stumbling block. How is a hobbyist, or anyone else for that matter, going to get one of these? The article does mention the vendor <http://www.protocase.com/> and a contact person there, but would backblaze be willing to let others use their design? I don't think it's included in the cost.

EDIT: Doh! Just had to open my eyes. Protocase says they offer the BackBlaze case on their home page. You have to email them for a quote.

</comment><comment><USER4> Direct link: [http://www.backblaze.com/petabytes-on-a-budget-how-to- build-...](http://www.backblaze.com/petabytes-on-a-budget-how-to-build-cheap- cloud-storage.html)

<comment><USER5> Which is the story from last September about cheap cloud storage.

They list 45 1.5TB drives at $120.00 each in their parts list, for $5,400 of the total. A quick poke around at Newegg and I am surprised to find the price equation hasn't changed that much. You can get slightly better bang/buck with 2TB drives but it isn't a knock-down win.

<comment><USER6> <http://forre.st/storage#sata> says you can get 1.5TB (new) for $80. That's a significant percentage lower than $120.

(And $53 (!) if you don't mind used.)

</comment></comment></comment><comment><USER7> I find it supremely ironic the following statement, "It almost doesn't make any cost sense to outsource your storage to the cloud with those cost savings. It really can be cheaper to bring it in house" being linked to a company whose purpose is to outsource your storage (in this base, backups) to the cloud.

Yes - I know that most of us backing up our 400 Gigabyte hard drives to backblaze aren't really in the same space as those people who really have petabytes of storage, but, Ironic nonetheless.

<comment><USER8> Only if you're trying to sell cloud storage on price.

</comment></comment><comment><USER9> One power supply for the motherboard and 3 banks of drives, one power supply for the rest of the drives. So either power supply fails and you're down. Obviously you would need to buy them in pairs. The article doesn't mention the cost of interconnecting all this stuff. I also wonder if they have thermal issues. It doesn't look great for storage of data that is frequently used, but for archival storage that is less hassle to access than tape.</comment>